2

I'm trying to get a new MacBook Pro running the latest version of Sierra to connect to my corporate VPN before the login screen. My machine is connected via Ethernet so I don't have to try and start Wi-Fi service prior to login. My command line script to connect to the VPN works fine in terminal. I know the file needs to be placed in /Library/LaunchDaemons/ but I'm not sure how to make sure it's processing before getting to the login screen. I'm new to writing plist files, so any help would be appreciated!

    <?xml version="1.0" encoding="UTF-8"?>
    <!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN"                         
    "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
    <plist version="1.0">
<dict>
<key>Label</key>
<string>com.vpn_at_boot</string>
<key>ProgramArguments</key>
<array>
    <string>sh</string>
    <string>-c</string>
    <string>sudo /usr/local/Cellar/sstp-client/1.0.11_1/sbin/sstpc vpn-hidden.hidden.com --user <hidden> --password <hidden> --log-stderr --cert-warn require-mschap-v2 noauth refuse-eap noccp</string>
</array>
<key>RunAtLoad</key>
<true/>

1

Your plist contains major errors and minor glitches. The proper plist - including stderr and stdout - looks like this:

<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
<plist version="1.0">
<dict>
    <key>Label</key>
    <string>com.vpn_at_boot</string>
    <key>ProgramArguments</key>
    <array>
        <string>/bin/sh</string>
        <string>-c</string>
        <string>/usr/local/sbin/sstpc vpn-redacted.redacted.com --user redacted --password redacted --log-stderr --cert-warn require-mschap-v2 noauth refuse-eap noccp</string>
    </array>
    <key>RunAtLoad</key>
    <true/>
    <key>StandardErrorPath</key>
    <string>/tmp/com.vpn_at_boot.err</string>
    <key>StandardOutPath</key>
    <string>/tmp/com.vpn_at_boot.out</string>
</dict>
</plist>

Replace redacted with the proper domain name, user and password in your plist.

Your plist misses important tags (e.g. </dict> and </plist>). It contains unnecessary stuff like sudo. The sstp-client may be updated later, so use its link in /usr/local/sbin. I also recommend to add /usr/local/sbin to /etc/paths.

The plist permissions have to look like this:

-rw-r--r--  1 root  wheel  - 682 Jun  9 13:38 /Library/LaunchDaemons/com.vpn_at_boot.plist

After running the daemon successfully (i.e. without errors) you may remove the keys StandardErrorPath and StandardOutPath and their corresponding strings in the plist.

  • Thank you very much! I'm disappointed I missed the closing tags, such a rookie mistake! I haven't written code in years. It's a fun challenge and I really appreciate the help here. Thank you for helping I'm off to test and will report back! – Darren Mason Jun 9 '17 at 15:30
  • Thanks again for helping with this script. The error logs are now showing: **Error: Could not lookup host: vpn.redacted.com, (-1) My guess is the script is running before the network interface is up and running. Is there a command to have the launch daemon wait until the interface is up and running? Or maybe a simple wait command? – Darren Mason Jun 9 '17 at 19:09
0

Once your plist is in the correct spot, /Library/LaunchDaemons, it should be OK.

LaunchAgents and LaunchDaemons are not easy to control or test. Can I suggest you grab a copy of Lingon which has a good GUI interface for the job, including testing.

  • Thank you, I did purchase a copy of Lingon and got successful tests, but it was adding some crazy path information and I'm still learning how it works. As indicated by original post, I have a lot to learn about the resulting code and how plists work. Thanks for mentioning Lingon, it's a great app and I look forward to using it more as I learn more! – Darren Mason Jun 9 '17 at 15:22

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .